usb
Library to access USB devices
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:install | AI (install-scripts): node-gyp-build is the standard install mechanism for native addons with prebuildify prebuilts; expected for a USB hardware binding. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt .node binaries for multiple platforms are the standard prebuildify pattern for native Node.js addons. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): False positive. 'usb' is a descriptive name for a USB library with 368k weekly downloads; not a typosquat of 'qs'. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is consumed at the C++ native addon build level (binding.gyp), not via JS imports. | ai | |
| phantom-deps | phantom-dep:@types/w3c-web-usb | AI (phantom-deps): TypeScript type definitions package; consumed by the type system, not via direct JS imports. | ai |
v2.17.0
3 findingsScript: node-gyp-build
Package contains compiled binaries that could be backdoors: • prebuilds/linux-arm/node.napi.armv6.node • prebuilds/android-arm/node.napi.armv7.node • prebuilds/linux-arm/node.napi.armv7.node • prebuilds/android-arm64/node.napi.armv8.node • prebuilds/linux-arm64/node.napi.armv8.node • prebuilds/linux-x64/node.napi.glibc.node • prebuilds/linux-x64/node.napi.musl.node • prebuilds/linux-ia32/node.napi.node • prebuilds/win32-arm64/node.napi.node • prebuilds/win32-ia32/node.napi.node ... and 1 more
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.9.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.